A vulnerability register needs eight columns: item, where it lives, advisory ID, whether it is exploited, owner, decision, due or revisit date, and status. Keep it in a shared spreadsheet, review it weekly, and archive closed rows. Anything more elaborate usually means it will stop being updated.
Why a register at all
Alerts live in tools that change. A register is your own record of decisions. It answers three questions a customer or auditor will ask: what did you know, what did you decide and when did you act. NIST's patch management guide frames the work as a cycle of finding, ranking, obtaining, deploying and confirming updates, and a register is where that cycle leaves its trail.
The eight columns
| Column | Example |
|---|---|
| Item | lodash 4.17.20 |
| Where | billing-api, production |
| Advisory ID | GHSA or CVE number |
| Exploited in the wild | Yes or no, with the date checked against the CISA catalog |
| Owner | A named person |
| Decision | Fix, defer, mitigate, accept |
| Revisit date | A real date |
| Status | Open, in progress, closed |
Add a ninth column for a link to the pull request or ticket if you need it.
Rules that keep it alive
- One row per decision, not per alert. Group twenty alerts from one package into one row.
- Every deferral has a reason and a date.
- Closed rows move to a second tab, not the bin. The history is the evidence.
- Review it in your weekly slot. If the review is skipped twice, shorten the sheet.
- The owner updates their rows. The triager does not do everyone's paperwork.
What about acceptance
Accepting a risk means someone with authority chooses to live with it. Write who, why and until when. A risk accepted for 90 days with a review date is a decision. A risk accepted forever is a forgotten item.
When a spreadsheet stops being enough
Move on when you manage many repositories, need automatic sync with scanners, or must show evidence in a standard format. The columns above translate directly into any tool, so nothing is wasted.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need a CVE number for each row?
No. Some advisories have just a GHSA or OSV identifier. Record whichever ID the source uses.
Who should be able to edit the register?
Owners edit their own rows, and one person reviews it. Keep edit history on so changes are traceable.
Safeguard compliance and evidence automation can keep this record for you, alongside the free scan at gold.safeguard.sh/scan.
Sources
- NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning
- CISA Known Exploited Vulnerabilities Catalog
Last reviewed: 19 October 2026.
